When you install the app they steal your contact list and populate their database that way. Most people are unaware of this, or don't care since we are a third world country and privacy is seen as a first world problem. The vast majority of thinking here is not very sophisticated about these types of topics. Only a very tiny fraction of the total population is averse to sharing personal information like phone numbers. It's common to see folks post their tax ID numbers etc on public forums, tweets, etc. too.
For a number of years it was quite common for folks in the lowest income brackets to change their phone numbers quite often because of rampant competition between mobile network providers. The "Mobile Number Portability" system was eventually introduced that minimized this to a large degree. Eventually the competition subsided and this reduced significantly to a point where it's not very common anymore per my understanding.
When I need to use Trucaller I use it via their web interface exclusively with a google account that has 0 contacts for them to steal. I remember finding my number listed many years ago as my name with (web developer) in parenthesis, likely stolen from some old customer of mine.
My wife installed TrueCaller on her phone. She is technical but not a developer.
I asked if she knows they steal your contact list and spy on you and her answer was “so? It’s just phone numbers and names and they need to get the data somewhere as they are providing the service for free”
I live in a developed country and we have a high standard of living.
Giving this anecdote to illustrate many people genuinely don’t see TrueCaller’s spying as a big deal. This is unfortunate but it’s how things often are.
It's worth noting that Instagram does this too, under the guise of "Find Your Friends." When you sign up for a new account, they aggressively prompt you to sync your contacts list with the app, and will continually prompt you in the future if you choose not to. Nearly all of my friends have this enabled.
This is not a one-time sync, either. It will upload future new contacts and changes.
And, finally, if you manage to create a new account without a phone number, Instagram appears to flag your account for suspicious activity at some point and mandates that you do. They can then correspond your phone number with other users' contact lists to determine your identity. It can even suss out if you provided a Google Voice/VOIP number and require a "real" one instead.
India has a huge problem with spam / robo callers. Also its common for individuals to have more than 1 phone number, see how popular dual sim phones are.
Also true caller adds security when you're from an under represented or a minority groups. I especially know women who use Truecaller to make sure they know who is calling / texting them from new numbers.
I’ve gone a few steps further and answered the “So?”. My wife thinks I’m a conspiracy nut even though I’ve provided proof of things that have happened. She thinks if it was that wide spread it would have been stopped already.
Fortunately we’ve agreed on not sharing kids pics and information on places like FB insta etc.
Honestly it's the same thing with the (well-educated) people who have their entire lives on the Google cloud and don't have an issue with the privacy practices of Facebook and Tiktok. They know the companies use their data and they don't mind or care - all they want are their free services.
To them features/functionality/cost is first, and privacy is an afterthought. I see this view in a lot of people nowadays.
We definitely need some scenarios where this kind of spying plays out badly for the user, so we can use them in arguments against these practices. Without examples, I can't blame users for calling these dangers hypothetical, really.
I'm old enough to remember telephone directories. Phone companies would publish listings of name, phone numbers and addresses of everyone who had a phone.
Fun fact: Elector rolls are public record. Your address is already out in the open.
> Giving this anecdote to illustrate many people genuinely don’t see TrueCaller’s spying as a big deal.
That's because it makes no material difference to them.
It used to be that the phone company would annually throw a book on your porch with everyone in your town's name, phone and address. I can see how someone with that as a mental model for contact lists wouldn't see a problem.
I think a lot of that comes from the fact that phone numbers being private at all is not a universal consideration. My town still, every year, sends me a paper book full of every resident's address and landline telephone.
Not that someone cares, but in the EU she would be responsible for violating the GDPR. Many people don't know that they are responsible as private citizens.
This illustrates the reverse lookup problem with these services. You can take pains to use a Google account with zero contacts. That safeguards the information of your contacts. But Trucaller already has your information because they get it from other people who have added you in their contacts list, and who aren't as privacy conscious as you are.
Can you explain what it is that gives you the right to hand other people's personal information to another entity?
Especially as part of a commercial transaction to a for-profit company?
"Hey, Bob! I'm going to give some company your name, phone number, occupation, and whatever else I know about you stored in my contact list in exchange for a beer. Is that OK?"
"When you install the app they steal your contact list and populate their database that way."
What if you avoid using the system default contacts store, i.e., keep it empty, and instead you use an app like OpenContacts.^1 To apps like TruCaller, it will appear the the user has no contacts.
Indias privacy laws are truly lacking. I am surprised that the government hasn’t enacted any laws for this yet.
I have a number of stories for this. Indians are so used to this that sometimes people are shocked when I say no to sharing information that they request.
For example in a startup, the HR reached out on WhatsApp to all employees in a group and asked for certain documents and information etc.
About Truecaller:
- It’s default opt in (with almost no way to opt out*)
- It requires access to your entire contact list - to mitigate this, I request Apple and Google to implement folders for contacts or something similar to how you can limit access to all photos on iOS per app. That way you can create an empty folder and share it with Truecaller
- It’s also impossible to change the wrong data that Truecaller somehow gets from some other contact list
My sibling recently got a new number and Truecaller assumed some other name and identity. Fellow Indians believe Truecaller more than they believe the person they are talking to (shows how much spam gets passed around)
This is NOT just TrueCaller. The same thing happens with Paytm and other payment apps.
Paytm for example assumed another identity and they requested us to submit multiple docs to prove our identity even though we never used the platform before. Even after multiple attempts and submitting multiple ids they refuse to change the data
In India, privacy is always secondary.
I remember, last time I was at jewelry shop in Western MH, I had to provide PAN card or Aadhar card since purchase warranted this check. W/o even thinking, folks in my family forwarded those details on Whatsapp.
Yeah, I truly wonder when 80 percent of population surviving on less than 2-3 dollars a day why doesn't government just double down on privacy first leaving everything else aside.
Not sure why you are being sarcastic. Being poor doesn’t mean people don’t deserve privacy. In fact it can enable for more business opportunities.
Government doesn’t operate in series on an issue one by one. This is why you have so many ministries in the govt. Just because roads don’t exist doesn’t mean govt should stop building railways and only think of roads.
I really like the idea to share a fake list. I think creating separate contact list folders is a bit much for the user, but adding a general permission grant option like "As if empty" or "Use placeholder" might be easier. An app requests my contacts? I can "grant" permission to an empty contacts list.
I think this idea generalizes to other permissions too. Want to know my location? I hit the "placeholder" button and the app gets some generic location that never changes. Valid data flows through, so the app can work, but not my private information.
I believe, Truecaller is an auto opt-in and you have to manually opt out if you want your number not be listed. I had to "unlist" my number manually. Check if your number is already in and then unlist at https://www.truecaller.com/unlisting
IIRC when looking into this some time ago, if someone who has your number uses truecaller then your number will reappear. So depending on your level of paranoia you might want to regularly check that unlisting page.
I just tried to put my phone number through it and it gave no indication of success or failure. Pulled up the debugger and see that it gives a 400 exception of "ProfileNotDeactivated" when I submit my number.
I find TrueCaller immensely useful. Especially to filter out and block spam callers. Spam calls and robocalls are a HUGE problem in India. TrueCaller flashes spam callers in red, you can reject the call and save a few precious minutes of your life. About half of the calls I receive a day are spam calls. If I were to answer them all and then reject it would be a waste of time and energy.
I used to use Truecaller, and it is useful, but it got gradually more and more obnoxious over the years, until eventually it would nag you about paid subscriptions whenever you opened the app, and throw up fullscreen ads whenever you received a phone call. So at that point I uninstalled it.
Most of these are not scammers trying to scare in the name of tax authorities or IT support scammers. They are mostly tele-callers trying to sell property, insurance, loans, credit cards and such. Nuisance nonetheless.
A cabinet minister (secretary in US administration) got a call like this out of the blue. That is when the India govt work up to the problem. Nothing was done so far though,
I have had many experiences where I tried to order tea at a small tea-stalls (digitally empowered) on the streets of India, and first thing they ask is my phone number! I reject anyone asking my phone number unless dire and a must-one. I also noticed that almost everyone will blurt out their number when anyone ask them.
Some businesses do exactly the same thing in the US. It is fascinating to be a bystander and hear how willing most people are to just give over their phone number. And of course, not just the store could be recording it, anybody within earshot could.
In the U.S., if it's a supermarket or a large chain store, they either sell it to other companies, or use it as a unique ID for your purchase history and customer profile. Sometimes both.
I'm not sure what a small-time tea stall would do.
back in 2011. i had "heard" about this. i had an iphone 3GS and an iphone 2G at the time. the 3GS had gotten ios5 if i remember correctly.
installing the app, it asked me very strangely to "allow truecaller to access your contacts". it took me a few moments to decide no. at the time, IOS had a "parental setting" to hide permissions behind a separate password, like location, contacts, payments, gallery, web, yada yada.
i learned that truecaller works on "you give your contacts and in exchange we give you a one way access to just search for numbers with names and not the other way around.
over time, it became ubiquitous, with people relying on it because "who saves a contact".
now its an obnoxious app that comes preinstalled on all cheap custom roms, shows full page ads every time it displays on screen after a call, it even shows up AFTER you have disabled screen overlays, i assume it gets preferential treatment by these rom makers,
this is the reason why i have never signed up to whatsapp or given facebook any contacts access or even 2fa ( old fb account, not logged in 3 years)
Truecaller was a royal PITA when it came to privacy until I figured out how to fuck with the system.
1. Anyone that has your phone number and Truecaller automatically gets you a name:phone_number entry in the Truecaller database. To get around this, I created a Truecaller account using my own phone number on a phone with zero contacts and gave myself a fake name(with my choice of subtle cuss words). This takes priority over other entries in the database. Am not sure if it works that way anymore.
2. Anytime I need to look up a number, I sign in using a dummy gmail account that I have.
There were a good few years where people looked up my number on Truecaller and it showed up a very obscene name that would shock em.
The best way to run truecaller is to install this app called 'Island'. This creates a new profile called work profile for you. Use a new google id for this work profile. Then install true caller inside island. I rarely use it but all I have to do is turn on the work profile, look up a number and then turn it back off.
I keep all crap apps in the work profile since there is a shortcut in the android drawer to turn it off and on in 1 click. I also assume it saves a bit of battery since these apps can't drain it while work profile is off.
Readit News
For a number of years it was quite common for folks in the lowest income brackets to change their phone numbers quite often because of rampant competition between mobile network providers. The "Mobile Number Portability" system was eventually introduced that minimized this to a large degree. Eventually the competition subsided and this reduced significantly to a point where it's not very common anymore per my understanding.
When I need to use Trucaller I use it via their web interface exclusively with a google account that has 0 contacts for them to steal. I remember finding my number listed many years ago as my name with (web developer) in parenthesis, likely stolen from some old customer of mine.
I asked if she knows they steal your contact list and spy on you and her answer was “so? It’s just phone numbers and names and they need to get the data somewhere as they are providing the service for free”
I live in a developed country and we have a high standard of living.
Giving this anecdote to illustrate many people genuinely don’t see TrueCaller’s spying as a big deal. This is unfortunate but it’s how things often are.
This is not a one-time sync, either. It will upload future new contacts and changes.
And, finally, if you manage to create a new account without a phone number, Instagram appears to flag your account for suspicious activity at some point and mandates that you do. They can then correspond your phone number with other users' contact lists to determine your identity. It can even suss out if you provided a Google Voice/VOIP number and require a "real" one instead.
https://help.instagram.com/195069860617299
Also true caller adds security when you're from an under represented or a minority groups. I especially know women who use Truecaller to make sure they know who is calling / texting them from new numbers.
Fortunately we’ve agreed on not sharing kids pics and information on places like FB insta etc.
To them features/functionality/cost is first, and privacy is an afterthought. I see this view in a lot of people nowadays.
Fun fact: Elector rolls are public record. Your address is already out in the open.
> Giving this anecdote to illustrate many people genuinely don’t see TrueCaller’s spying as a big deal.
That's because it makes no material difference to them.
Especially as part of a commercial transaction to a for-profit company?
"Hey, Bob! I'm going to give some company your name, phone number, occupation, and whatever else I know about you stored in my contact list in exchange for a beer. Is that OK?"
What if you avoid using the system default contacts store, i.e., keep it empty, and instead you use an app like OpenContacts.^1 To apps like TruCaller, it will appear the the user has no contacts.
1. https://f-droid.org/packages/opencontacts.open.com.openconta...
https://github.com/sultanhamer/opencontacts
https://github.com/sultanahamer/opencontacts
I started using TrueCaller some 8 years back and the biggest reason for me to use it was to prevent Robo callers/spams.
Oh it's the classist "I'm smarter than the average person in my country" crowd again.
Why do you assume you know better? Perhaps they know what they're trading and perhaps it's worth the cost.
Guess which one gets all the apps - It's definitely not the one that costs me over 100$/mo to maintain!
I also want to minimize their information about my network.
Dead Comment
I have a number of stories for this. Indians are so used to this that sometimes people are shocked when I say no to sharing information that they request.
For example in a startup, the HR reached out on WhatsApp to all employees in a group and asked for certain documents and information etc.
About Truecaller: - It’s default opt in (with almost no way to opt out*)
- It requires access to your entire contact list - to mitigate this, I request Apple and Google to implement folders for contacts or something similar to how you can limit access to all photos on iOS per app. That way you can create an empty folder and share it with Truecaller
- It’s also impossible to change the wrong data that Truecaller somehow gets from some other contact list
My sibling recently got a new number and Truecaller assumed some other name and identity. Fellow Indians believe Truecaller more than they believe the person they are talking to (shows how much spam gets passed around)
This is NOT just TrueCaller. The same thing happens with Paytm and other payment apps.
Paytm for example assumed another identity and they requested us to submit multiple docs to prove our identity even though we never used the platform before. Even after multiple attempts and submitting multiple ids they refuse to change the data
Aadhaar - “Universal” identifier. Needed for pretty much anything. Including, apparently, buying jewellery.
Government doesn’t operate in series on an issue one by one. This is why you have so many ministries in the govt. Just because roads don’t exist doesn’t mean govt should stop building railways and only think of roads.
I think this idea generalizes to other permissions too. Want to know my location? I hit the "placeholder" button and the app gets some generic location that never changes. Valid data flows through, so the app can work, but not my private information.
Seems seriously shady.
How do you check whether your number is "in"?
Once you do, you have to log in with either your Google or Microsoft identity and agree to let them download your contacts.
Deleted Comment
I'm not sure what a small-time tea stall would do.
back in 2011. i had "heard" about this. i had an iphone 3GS and an iphone 2G at the time. the 3GS had gotten ios5 if i remember correctly.
installing the app, it asked me very strangely to "allow truecaller to access your contacts". it took me a few moments to decide no. at the time, IOS had a "parental setting" to hide permissions behind a separate password, like location, contacts, payments, gallery, web, yada yada.
i learned that truecaller works on "you give your contacts and in exchange we give you a one way access to just search for numbers with names and not the other way around.
over time, it became ubiquitous, with people relying on it because "who saves a contact".
now its an obnoxious app that comes preinstalled on all cheap custom roms, shows full page ads every time it displays on screen after a call, it even shows up AFTER you have disabled screen overlays, i assume it gets preferential treatment by these rom makers,
this is the reason why i have never signed up to whatsapp or given facebook any contacts access or even 2fa ( old fb account, not logged in 3 years)
fuck truecaller
1. Anyone that has your phone number and Truecaller automatically gets you a name:phone_number entry in the Truecaller database. To get around this, I created a Truecaller account using my own phone number on a phone with zero contacts and gave myself a fake name(with my choice of subtle cuss words). This takes priority over other entries in the database. Am not sure if it works that way anymore.
2. Anytime I need to look up a number, I sign in using a dummy gmail account that I have.
There were a good few years where people looked up my number on Truecaller and it showed up a very obscene name that would shock em.
I hate Truecaller so much!
I keep all crap apps in the work profile since there is a shortcut in the android drawer to turn it off and on in 1 click. I also assume it saves a bit of battery since these apps can't drain it while work profile is off.